3

I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason.

I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the problem, but I was unable to find where is the problem.

ntlm_auth is working:

ntlm_auth --username=ferrao --request-nt-key
Password: 
NT_STATUS_OK: Success (0x0)

But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message:

(9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}
(9) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}}
(9) mschap :    --> --username=ferrao
(9) mschap : Creating challenge hash with username: ferrao
(9) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00}
(9) mschap :    --> --challenge=082e8ba7b848aaae
(9) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00}
(9) mschap :    --> --nt-response=27b40a6d1dba1b4acfd33aff5c710a43e70d050269087bf1
(9) ERROR: mschap : Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)'
(9) mschap : External script failed.
(9) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001)
(9) ERROR: mschap : MS-CHAP2-Response is incorrect
(9)   [mschap] = reject
(9)  } # Auth-Type MS-CHAP = reject
(9) eap : Freeing handler
(9)   [eap] = reject
(9)  } #  authenticate = reject
(9) Failed to authenticate the user.
(9) Login incorrect (mschap: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)'): [ferrao/<via Auth-Type = EAP>] (from client 146.164.136.0/26 port 0 via TLS tunnel)

So something is wrong with Winbind and FreeRADIUS, and I don't know what.

Thanks in advance,

2

Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and then make sure that the privileged pipe is owned by root:winbindd_priv.

The winbind privileged pipe is usually in /var/lib/samba/winbindd_privileged/, or a similar location under /var/.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.